PT-2026-51881 · Linux · Linux

Published

2026-06-24

·

Updated

2026-06-24

·

CVE-2026-52987

None

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: avoid double drm exec fini() in userq validate
When new addition is true, amdgpu userq vm validate() calls drm exec fini(&exec) before iterating over the collected HMM ranges and calling amdgpu ttm tt get user pages().
If amdgpu ttm tt get user pages() fails in that path, the code jumps to unlock all and calls drm exec fini(&exec) a second time on the same exec object. drm exec fini() is not idempotent: it frees exec->objects and may also drop exec->contended and finalize the ww acquire context.
Route that error path directly to the range cleanup once exec has already been finalized.
Issue found using a prototype static analysis tool and confirmed by code review.
(cherry picked from commit 2802952e4a07306da6ebe813ff1acacc5691851a)
Found an issue in the description? Have something to add? Feel free to write us 👾

Related Identifiers

CVE-2026-52987

Affected Products

Linux